A Technical History of the SEI

Since its initial development in 2005, SQUARE has been adapted to acquisition and extended to
include privacy; tools have been developed to support its use.
In addition to developing analysis methods and tools, SEI researchers explored ways to identify
organizational and systemic risks that could affect software security. The Mission Assurance
Analysis Protocol [Alberts 2005] was initiated to identify
and understand inherent operational risks when management
control of work processes is distributed among
The View from Others
multiple organizations. The Vendor Risk Assessment Our company provided them with
and Threat Evaluation [Lipson 2001] was developed to an opportunity to assess a manyfaceted
product and they re-
assess vendor capabilities as an indicator of product
quality. In late 2006, the SEI began research on supply sponded graciously by sharing the
chain integrity [Ellison 2010a]; SEI experts defined risk different techniques they used to
management approaches (see paper by Croll [Croll analyze the security aspects of our
2013]) that can be used during acquisition, development, application. Their results gave us
and transit, as well as when components are integrated insight that has since influenced
with other software and when changes occur in the environment
and in attack techniques after deployment. To configuration.
our application development and
address complexity, the SEI developed two frameworks, – SQUARE client, a software
starting in 2008—the Survivability Analysis Framework development company
[Ellison 2010b], a structured view of people, activities,
We identify 23 activities that are
and technology that helps organizations characterize the
essential to engineer complete and
complexity of dynamic multi-system and multi-organizational
business processes and the Software Assurance
detailed security requirements. We
use these 23 activities as a basis to
Modeling Framework [Siviy 2009], which enables organizations
to tie their current environment to opera-
compare five different requirements
engineering processes. Our
tional needs and identify areas where they can improve
analysis shows that SQUARE incorporates
more of these activities
assurance. In 2010, the SEI began work on a risk-based
approach for measuring and monitoring the security
than other processes.
characteristics of interactively complex, software-reliant
– Muhammad Umair Ahmed
systems across the lifecycle and supply chain. The Integrated
Measurement Analysis Framework [Alberts 2010]
Khan and Mohammed
Zulkernine
integrates performance data for individual components to
[Khan 2009]
provide a consolidated view of system performance. The
Mission Risk Diagnostic [Alberts 2012] analyzes the risk
to the system as a whole for a comprehensive view of the overall risk to a system’s mission.
In 2013, with DHS sponsorship, the SEI created a cybersecurity risk management strategy to aid
alert originators planning to use the new wireless emergency alerting (WEA) capability implemented
by the Federal Emergency Management Agency (FEMA) in April 2013 [Woody 2013].
They can use the strategy throughout WEA adoption, operations, and sustainment to decrease vulnerability
to attack and manage risk in the face of changing threats. As part of this effort, the SEI
is also working with the developers of alert originator software to increase WEA cybersecurity.
Recognizing that the principle of building security in at the start had to extend to the workforce,
DHS sponsored the SEI to build a model curriculum for software assurance education. The SEI
CMU/SEI-2016-SR-027 | SOFTWARE ENGINEERING INSTITUTE | CARNEGIE MELLON UNIVERSITY 193
Distribution Statement A: Approved for Public Release; Distribution is Unlimited.